Missing hard drive has health information of 650 heart patients, AHS says
Device 'unencrypted and non-password protected'
The personal health information of 650 heart patients was on a hard drive that went missing from the Mazankowski Alberta Heart Institute, Alberta Health Services has revealed.
The external hard drive, "unencrypted and non-password protected," went missing from a Cardiac Sciences outpatient clinical procedure lab, AHS said in a news release Monday.
The missing hard drive may be linked to a theft inside the clinical procedure lab on Aug. 5 — the Monday of the August long weekend — but it wasn't identified as missing until a few weeks later.
"Certain mandatory encryption policies were not followed in this case and that is unacceptable," Dr. Mark Joffe, vice-president and medical director, Northern Alberta, said in the release.
"The policies were reviewed with staff to prevent any future issues. Security measures and building access for statutory holidays have also been reviewed by AHS Security and new changes will prevent future issues with inappropriate access to the lab."
Police investigation now closed
The theft at the lab was "thoroughly investigated" by AHS Protective Services and AHS Privacy, and by the Edmonton Police Service, AHS said.
The missing hard drive has not been recovered and police have closed their investigation, AHS said. Patient care is not affected by the missing items, it said.
Personal patient information on the drive included patient names, gender, dates of birth, physician name and medical record numbers, which are not the same as Alberta personal health care numbers.
AHS is now notifying patients whose information was on the hard drive. People receiving letters will be able to contact a dedicated call-line available through Health Link to ask any questions they may have.
"We know this news will be stressful for those affected and we apologize for any worry this may cause," Joffe said. "We would like to note that the nature of the data on the drive would make it very difficult for someone to use just on its own."
Alberta Health and the Office of the Information and Privacy Commissioner have been informed, AHS said.